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Claims- 

11. A method of preventing virus infection by detecting the 

2 virus infection in a network, comprising steps of" 

3 providing a decoy accessible through the network to a 

4 computer that monitors intrusion of a virus; 

5 receiving access to said decoy through the network, to 

6 obtain communication information and to detect intrusion of the 

7 virus; 

8 detecting a virus source computer based on the 

9 communication information obtained with respect to the virus 

10 intrusion when the virus intrudes into the decoy; and 

11 making an antivirus attack on the virus source computer 

12 through the network for suppressing operation of the virus. 

12. A method of preventing virus infection according to Claim 

2 1, wherein: 

3 said decoy is one or more of a decoy folder stored in a 

4 storage unit, a decoy application stored in the storage unit, and a 

5 server formed virtually in the storage unit. 

13. A method of preventing virus infection according to Claim 

2 1, wherein: 

3 said attack is made by imposing a high load on the virus 

4 source computer. 

14. A method of preventing virus infection according to Claim 
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2 3, wherein* 

3 said high load is imposed on the virus source computer by 

4 increasing traffic of said computer. 

15. A method of preventing virus infection according to Claim 

2 3, wherein* 

3 said high load is imposed on the virus source computer by 

4 sending a large number of requests to which a CPU of said 

5 computer should respond. 

16. A system for preventing virus infection by detecting the 

2 virus infection in a network, comprising" 

3 a decoy means that can be accessed through the network; 

4 a communication information analysis means that detects 

5 intrusion of a virus into said decoy means, and then on detecting 

6 virus intrusion, detects a virus source computer based on 

7 communication information obtained when the virus intrudes," and 

8 a computer attack means that makes an antivirus attack 

9 on the virus source computer through the network, for 
10 suppressing operation of the virus. 

17. A system for preventing virus infection according to Claim 

2 6, wherein" 

3 said decoy means is one or more of a decoy folder stored in 

4 a storage unit, a decoy application stored in the storage unit, and 

5 a server formed virtually in the storage unit. 

18. A system for preventing virus infection according to Claim 



23 



1 

ES1904 

2 6, wherein* 

3 said computer attack means imposes a high load on the 

4 virus source computer. 

19. A method of preventing virus infection in a system for 

2 preventing virus infection according to Claim 8, wherein" 

3 said computer attack means imposes the high load on the 
. 4 virus source computer by increasing traffic of said computer. 

1 10. A system for preventing virus infection according to Claim 

2 8, wherein-* 

3 said computer attack means imposes the high load on the 

4 virus source computer by sending a large number of requests to 

5 which a CPU of said computer should respond. 

1 11. A system for preventing virus infection according to one of 

2 Claims 8, 9 and 10, wherein' 

3 said system further comprises a detection report 

4 transmission means that sends a detection report to an 

5 administrator of the virus source computer* and 

6 said computer attack means continues to make the 

7 antivirus attack on the virus source computer until a 

8 countermeasure against the virus has been completed. 

1 12. A system for preventing virus infection according to Claim 

2 6, wherein* 

3 said decoy means is a decoy folder realized by an 

4 application provided in a decoy server that is formed virtually in 
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5 a storage unit of a computer connected to the network. 

1 13. A system for preventing virus infection according to Claim 

2 6, wherein" 

3 said decoy means is a decoy application realized as an 

4 application provided in a decoy server that is formed virtually in 

5 a storage unit of a computer connected to the network. 

1 14. A system for preventing virus infection according to one of 

2 Claims 8, 9 and 10, further comprising: 

3 a message sending means that sends a message of 

4 announcing a start of the attack imposing the high load to the 

5 infected computer. 

1 15. A system for preventing virus infection according to one of 

2 Claims 8, 9 and 10, further comprising: 

3 an alarm sound generation means that generates an alarm 

4 sound in an attacking terminal unit at a start of the attack or 

5 after the start of the attack. 

1 16. A system for preventing virus infection according to one of 

2 Claims 8, 9 and 10, further comprising: 

3 a requesting means that notifies a network address of the 

4 virus source computer to another computer connected to the 

5 network and requests to said computer for making an antivirus 

6 attack on the virus source computer. 

1 17. A system for preventing virus infection by detecting the 
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2 virus infection in a network, comprising: 

3 a request receiving means that receives a request for 

4 making an antivirus attack on a virus source computer; and 

5 a computer attack means that makes an antivirus attack 

6 on said virus source computer through the network for 

7 suppressing operation of a virus, based on said request received. 

1 18. A program for making a computer prevent virus infection 

2 by detecting the virus infection in a network, wherein: 

3 said program makes said computer realize: 

4 a communication information analysis means that detects 

5 intrusion of a virus into a decoy means accessible through the 

6 network, and then on detecting virus intrusion, detects a virus 

7 source computer based on communication information obtained 

8 when the virus intrudes; and 

9 a computer attack means that makes an antivirus attack 

10 on the virus source computer through the network, for 

11 suppressing operation of the virus. 

1 19. A program for making a computer prevent virus infection 

2 by detecting the virus infection in a network, wherein: 

3 said program makes said computer perform processing of 

4 rejecting communication from a virus source computer when a 

5 network address of the virus source computer is notified. 
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